Trains models, in Colombia

Ley 599 de 2000, art. 269A (added by Ley 1273 de 2009) · Read the law's page

• Do not access a computer system, whether or not it is protected by a security measure, without authorization or beyond what the system's owner agreed to, and do not remain in it against the will of the person entitled to exclude you.
• This article's authorization test does not turn on defeating a technical access control, so it may reach unauthorized access to a public, unauthenticated page; no confirming Colombian decision exists.

Ley 599 de 2000, art. 269F (added by Ley 1273 de 2009) · Read the law's page

• Do not obtain, compile, extract, or use personal data contained in a file, archive, or database without the controller's authorization, even for data found on a public web page.
• A datum being accessible on the internet does not exempt collecting it from Colombia's personal-data authorization requirements.

Ley 23 de 1982, art. 12 (as amended by Ley 1915 de 2018) · Read the law's page

• Obtain the author's authorization before reproducing a copyrighted work by any means, including temporary electronic storage during crawling, since no text-and-data-mining exception applies.
• Do not rely on the quotation, teaching, or private-copy exceptions to reproduce copyrighted text at scale for model training; they are narrow and conditioned on non-commercial, limited use.

SIC Circular Externa 002 de 2024, instrucciones I, II, VIII-IX (Lineamientos sobre Tratamiento de Datos en Sistemas de IA), 21 de agosto de 2024 · Read the law's page

• Before collecting personal data from the internet to develop, train, test or deploy an artificial intelligence system, obtain the data subject's prior, express and informed authorization; a datum being accessible online does not make it a public datum exempt from that requirement.
• Weigh whether processing personal data in an artificial intelligence system is suitable to the goal pursued, necessary because no less intrusive measure achieves it equally well, reasonable because it serves a constitutional purpose, and proportionate because its benefits are not outweighed by the harm to the right to data protection.
• Where you cannot be certain an artificial intelligence system's processing will not cause serious, irreversible harm, refrain from that processing or adopt precautionary measures, and adapt your risk management systems to identify, measure, control and monitor the situations that could affect your compliance with personal data protection rules.
• Complete and document a privacy impact assessment before an artificial intelligence system likely to pose a high risk to data subjects processes their personal data, covering the processing operations, a risk evaluation, and the measures planned to prevent the risks identified.
• Only process truthful, complete, exact, updated, verifiable and understandable personal data in an artificial intelligence system, and do not process partial, incomplete, fragmented or misleading personal data.
• Apply privacy by design and by default, including techniques such as differential privacy, so that data used to train an artificial intelligence system does not allow the person who provided it to be identified.
• Adopt technological, human, administrative, physical and contractual security measures to prevent unauthorized access to, manipulation, destruction, or unauthorized use or circulation of personal data processed in an artificial intelligence system, and keep those measures auditable by the authorities.

Proyecto de Ley 043 de 2025 Senado / 324 de 2025 Cámara, filed 28 July 2025 by the Ministry of Science, Technology and Innovation (MinCiencias); urgency message filed 8 September 2025

• This measure is in committee and binds nobody yet; what follows is what it would require if it is enacted in this form.
• Do not deploy AI systems that pose unacceptable risks, such as subliminal behavioral manipulation or social scoring.
• Obtain explicit consent before using individuals' works, voices or images in AI development.